A New Related Message Attack on RSA

Abstract

Coppersmith, Franklin, Patarin, and Reiter show that given two RSA cryptograms x ^e mod N and (ax+b)^e mod N for known constants a,b ∈ ℤ _N , one can usually compute x in O(elog ² e) ℤ _N -operations (there are O(e ²) messages for which the method fails).

We show that given e cryptograms c _i ≡ (a _i x+b _i )^e mod N, i=0,1,...e–1, for any known constants a _i ,b _i  ∈ ℤ _N , one can deterministically compute x in O(e) ℤ _N -operations that depend on the cryptograms, after a pre-processing that depends only on the constants. The complexity of the pre-processing is O(elog ² e) ℤ _N -operations, and can be amortized over many instances. We also consider a special case where the overall cost of the attack is O(e) ℤ _N -operations. Our tools are borrowed from numerical-analysis and adapted to handle formal polynomials over finite-rings. To the best of our knowledge their use in cryptanalysis is novel.